From 4541ee21203f7c494530f142a6387244ac3a6c62 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sat, 23 May 2026 20:04:06 +0300 Subject: 0c promote aggregate-only sampling defaults in raw output modes Default aggregate-only sampling (rate 0) for futex* and clock_gettime causes BPF to suppress ring-buffer events. In -plain, -flamegraph, and headless -parquet modes there is no aggregate sink, so these probes would emit no rows even when explicitly selected. Promote those defaults to rate 1 during flag resolution; user-explicit overrides are preserved. Co-Authored-By: Claude Opus 4.7 --- internal/flags/sampling.go | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'internal/flags/sampling.go') diff --git a/internal/flags/sampling.go b/internal/flags/sampling.go index 0f0af2a..5656f0a 100644 --- a/internal/flags/sampling.go +++ b/internal/flags/sampling.go @@ -49,6 +49,23 @@ func mergeSyscallSamplingRates(overrides map[string]uint32) map[string]uint32 { return out } +// promoteAggregateOnlyForRawOutput replaces default aggregate-only rates (0) +// with rate 1 (emit every event) when running in a raw output mode that lacks +// an aggregate sink. Without this promotion, BPF suppresses ring-buffer +// events for these syscalls and no rows appear in -plain, -flamegraph, or +// headless -parquet output. User-explicit overrides (present in userOverrides) +// are preserved unchanged. +func promoteAggregateOnlyForRawOutput(merged map[string]uint32, userOverrides map[string]uint32) { + for _, syscall := range defaultAggregateOnlySyscalls { + if _, explicit := userOverrides[syscall]; explicit { + continue + } + if merged[syscall] == 0 { + merged[syscall] = 1 + } + } +} + func parseFamilySamplingRates(raw string) (map[types.SyscallFamily]uint32, error) { entries, err := parseSamplingEntries(raw) if err != nil { -- cgit v1.2.3